High-Volume External Threat Exploitation Attempts Against Public IPs
Detects high-volume vulnerability and spyware threat activity originating from external (UNTRUSTED) sources targeting public-facing IP addresses. This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware. The rule triggers when: A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts) Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
Cortex XDR
